By Daniel de Almeida Afonso · Last updated: October 12, 2026
The CPRA amended the California Consumer Privacy Act (CCPA), so there is now one law to follow: Civil Code section 1798.100 and the regulations at Title 11, section 7000 and following. If your business is covered, you must publish accurate notices, honor opt-outs including browser signals, answer consumer requests within 45 days, sign the right contracts with vendors, and prepare for risk assessments, cybersecurity audits, and automated decision-making rules that phase in between 2026 and 2030. Fines reach $2,663 per violation, or $7,988 per intentional violation or one involving a consumer the business knows is under 16, and there is no automatic cure period.
This checklist is general information, not legal advice. For the law and consumer rights in depth, see our CCPA requirements guide.
Who must comply: a three-question test
A business must comply if it meets all of the first two conditions and at least one of the three thresholds in the third.
- Is it a for-profit business? The law covers entities organized or operated for the profit or financial benefit of their owners. Nonprofits are generally outside this definition.
- Does it do business in California and decide why and how personal information is processed? Where you are headquartered does not decide it. What counts is your activity in California.
- Does it meet at least one threshold?
- Annual gross revenue above $26,625,000 in the preceding calendar year. The statute's original figure was $25,000,000, and the California Privacy Protection Agency (CPPA) raised it for inflation effective January 1, 2025.
- Buys, sells, or shares the personal information of 100,000 or more consumers or households each year.
- Earns 50 percent or more of annual revenue from selling or sharing personal information.
The second threshold catches more businesses than people expect, because "sharing" includes passing data to ad platforms through pixels and cookies. An entity that controls or is controlled by a covered business, shares its branding, and shares personal information with it is also covered.
The CPPA must adjust the dollar figures every odd-numbered year, so the next adjustment is scheduled for January 1, 2027. Check the agency's monetary thresholds page each January.
"Consumer" means any California resident, so employees, job applicants, and business contacts count. The temporary exemptions for employee and business-to-business data expired on January 1, 2023. See CPRA and employee data for the HR side.
Step 1: Map your data and limit what you collect
You cannot write an accurate notice for data you have not mapped.
▢ List every category of personal information you collect, where it comes from, why you collect it, who receives it, and how long you keep it.
▢ Flag the categories that are sensitive personal information (see Step 4).
▢ Flag every sale or sharing, including ad pixels, SDKs, and analytics tools that pass data to third parties.
▢ Test each purpose against the statute's standard: collection, use, retention, and sharing must be reasonably necessary and proportionate to the purpose you disclosed, or to a compatible purpose.
▢ Set a retention period for each category. You will have to publish it.
If you want to use data for a new, unrelated purpose, update your notices and get the consumer's consent first. The regulations allow an unrelated purpose only with consent.
Step 2: Publish the right notices
California requires several notices. Each has its own content rules in the regulations.
Notice at collection
This notice must reach people at or before the point of collection. If you do not give it, you are not allowed to collect the data. It must list:
- the categories of personal information collected, including sensitive categories
- the purposes for each category
- whether each category is sold or shared
- how long you keep each category, or the criteria you use to decide
- a link to your opt-out page if you sell or share
- a link to your privacy policy
Online, the notice can be a link that goes straight to the relevant section of your privacy policy. Dropping people at the top of a long policy does not count.
Privacy policy
Your privacy policy must cover your online and offline practices for the previous 12 months, describe every consumer right and how to use it, and be updated at least once every 12 months. It must be reachable through a conspicuous link containing the word "privacy" on your homepage and, for apps, in the app's settings menu. It must also be printable.
Put a recurring review date in your compliance calendar and update the "last updated" line each time.
Notice of financial incentive
If you offer loyalty rewards, discounts, or payments in exchange for personal information, describe the program's material terms and enroll people only with prior opt-in consent that they can revoke at any time. If someone refuses, wait at least 12 months before asking again.
Step 3: Build working opt-out and limit controls
Complete this step only if you sell or share personal information, or use sensitive personal information beyond the purposes the law allows.
▢ "Do Not Sell or Share My Personal Information" link. Put it on your homepage. It must lead to a page where people can opt out.
▢ "Limit the Use of My Sensitive Personal Information" link. Required if you use sensitive data for purposes beyond those the statute permits.
▢ Or one combined link. You may use a single link titled "Your Privacy Choices" or "Your California Privacy Choices," with the CPPA's opt-out icon beside it, placed in the header or footer. It must open a page that explains both rights and lets people exercise both.
▢ Honor opt-out preference signals. If you sell or share personal information, you must treat a valid signal, such as Global Privacy Control (GPC), as an opt-out request for that browser or device and for any profile you link to it. Do not ask for extra information to apply it. The regulations require online sellers and sharers to accept signals alongside at least one other opt-out method.
▢ Offer two or more ways to opt out, one matching how you mainly deal with consumers.
▢ Act within 15 business days. Stop selling or sharing as soon as feasible, and no later than 15 business days after the request arrives.
▢ Do not ask again for 12 months before requesting permission to sell, share, or use sensitive data further. Do not require an account to opt out.
Test on a clean browser with GPC switched on. The California Attorney General's enforcement page describes noncompliance notices over ignored GPC signals, opt-out links that did nothing, and broken notice links.
Children and teens
If you know a consumer is under 16, you may not sell or share their personal information without opt-in authorization. For ages 13 to 15, the teen gives it. Under 13, a parent or guardian does. A business that willfully disregards age is treated as knowing it.
Step 4: Handle sensitive personal information
Sensitive categories in the statute include government ID numbers, account log-ins with credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, private message contents, genetic data, biometric data used to identify a person, health data, and data about sex life or sexual orientation. Confirm the current list in the statute, because the Legislature amends it.
▢ Decide which sensitive data you truly need, and document the purpose.
▢ If you use it for anything beyond the service the consumer asked for, add the limit link from Step 3 and honor limit requests within 15 business days.
▢ Check whether processing it triggers a risk assessment (Step 8).
Step 5: Set up the process for consumer requests
Consumers have the right to know, delete, correct, opt out of sale and sharing, and limit the use of sensitive information. They also have the right not to be treated worse for using any of these rights. From January 1, 2027, rights to opt out of and access information about automated decision-making technology (ADMT) will apply too.
▢ Offer two or more methods to submit requests.
▢ Confirm receipt within 10 business days.
▢ Respond within 45 calendar days of receipt. The clock starts when you receive the request, not when you finish verifying it. You may extend once by 45 days, for 90 in total, if you tell the consumer within the first 45.
▢ Deliver access responses free of charge, in a readily usable format that lets people move the data to another entity.
▢ On a deletion request, delete from your records, tell service providers and contractors to delete, and tell third parties that bought or received the data, unless that proves impossible or involves disproportionate effort.
▢ Keep a log of each request and your response for at least 24 months.
▢ Do not discriminate. No denied service, different prices, or lower quality because someone used a right, unless the difference is reasonably related to the value of their data.
Step 6: Fix your vendor contracts
Contracts are among the most commonly missed items, because the regulations list specific terms. A service provider or contractor contract must:
- prohibit selling or sharing the personal information
- name the specific business purposes, not generic ones
- prohibit using the data for any other purpose, outside the direct relationship, or combined with data from other sources unless allowed
- require compliance with the CCPA and the same level of privacy protection
- let you take reasonable steps to confirm compliant use, such as audits or scans
- require the vendor to tell you if it can no longer meet its obligations
- let you stop and remediate unauthorized use
- require the vendor to help you meet consumer requests
The contract may also require help with your cybersecurity audit, risk assessment, and ADMT duties. Subcontractors need compliant contracts too, and third parties that receive data from you have their own required terms.
Due diligence matters. A business that never enforces its contract or checks its vendors may struggle to argue it had no reason to believe a vendor was misusing data. For definitions and edge cases, read CCPA service providers, contractors, and third parties.
Step 7: Train the people who answer consumers
The statute and regulations do not require a general training program for all staff. They do require that everyone who handles consumer inquiries about your privacy practices or CCPA compliance is informed of the requirements and knows how to direct consumers to exercise their rights.
A business that buys, receives, sells, or shares the personal information of 10 million or more consumers in a calendar year has more to do. It must keep a documented training policy. It must also compile request metrics for the prior year and publish them by July 1.
Below that size, written training for support, HR, and marketing teams is the simplest way to show you meet the "informed" standard.
Step 8: Prepare for risk assessments, cybersecurity audits, and ADMT
These requirements come from regulations effective January 1, 2026. Most have later compliance dates, so the work is planning now.
| Requirement | Who it applies to | Key date |
|---|---|---|
| Risk assessment | Businesses that sell or share personal information, process sensitive personal information, use ADMT for significant decisions, or do certain profiling or ADMT training | Before starting new covered processing from January 1, 2026. For processing already underway, by December 31, 2027 |
| Risk assessment submission | Same businesses | April 1, 2028 for assessments done in 2026 and 2027, then by April 1 each following year |
| Cybersecurity audit | Businesses that earn 50 percent or more of revenue from selling or sharing, or that exceed the revenue threshold and process data on 250,000 or more consumers or sensitive data on 50,000 or more | First report by April 1, 2028 (2026 revenue over $100 million), April 1, 2029 ($50 million to $100 million), or April 1, 2030 (under $50 million) |
| ADMT rules | Businesses that use ADMT for significant decisions about consumers | January 1, 2027 |
A few details to plan around:
- Risk assessments must be reviewed at least every three years, updated within 45 calendar days of a material change, and kept for five years or as long as the processing continues, whichever is later.
- A "significant decision" means one that results in the provision or denial of financial or lending services, housing, education, employment or contracting opportunities or compensation, or healthcare services. Advertising is excluded.
- ADMT duties include a pre-use notice, an opt-out right, and a right to access, with some exceptions.
- Cybersecurity audits must be done by a qualified, objective, independent professional.
The table is a summary. Read the dedicated ADMT regulations guide before you scope the work.
Step 9: Know the penalties and who enforces
Both the CPPA and the California Attorney General enforce the law. The CPPA can impose administrative fines, and the Attorney General can seek injunctions and civil penalties. Each can seek up to $2,663 per violation, or up to $7,988 per intentional violation and per violation involving a consumer the business knows is under 16. These are the inflation-adjusted amounts effective January 1, 2025, up from the statute's original $2,500 and $7,500. The next adjustment is due January 1, 2027.
Separately, consumers can sue after certain data breaches caused by inadequate security, for $107 to $799 per consumer per incident, or actual damages if higher. Only that breach claim has a 30-day cure opportunity. For regulator enforcement, the Attorney General's website states that since January 1, 2023, a business is not guaranteed notice or a chance to cure. The CPPA may allow time to cure but is not required to.
Enforcement is active. A CPPA announcement dated September 30, 2025 reported a $1.35 million settlement with a retailer over CCPA violations. The Attorney General's published examples center on opt-outs that fail in practice and missing or broken notices.
Where to go next
- Marketing agencies and ad-tech teams: the CCPA checklist for digital marketing agencies.
- The CPRA amendments in detail: the CPRA full text summary, written in 2022, so it predates the current thresholds and regulations.
Frequently asked questions
Is the CPRA a separate law from the CCPA?
No, the CPRA is an amendment to the CCPA, so you follow one statute at Civil Code section 1798.100 and following. The CPRA took effect January 1, 2023, and added the rights to correct data and to limit the use of sensitive data, and created the CPPA.
Does a small business have to comply with the CCPA?
Only if it meets a threshold: more than $26,625,000 in annual gross revenue, 100,000 or more consumers or households, or 50 percent or more of revenue from selling or sharing data. A small business can still qualify through the last two, for example through heavy ad tracking.
Do I need a "Do Not Sell or Share" link?
Yes, if you sell or share personal information, either as that link or as the combined "Your Privacy Choices" link. Alternatively, the statute lets you skip the links if you let consumers opt out through a preference signal, but the regulations still require online sellers and sharers to process signals like GPC.
How long do I have to respond to a consumer request?
You have 45 calendar days from receipt, extendable once by 45 more days if you notify the consumer. You must confirm receipt within 10 business days. Opt-out and limit requests are faster: stop within 15 business days.
Does the CCPA cover employee and job applicant data?
Yes, since January 1, 2023, when the temporary employment and business-to-business exemptions ended. Employees, applicants, and contractors have the same core rights, and HR data needs a notice at collection.
Is there a grace period before I get fined?
No automatic one. The old 30-day cure period for regulator enforcement ended on January 1, 2023, and the CPPA decides case by case whether to offer time to cure. Fix gaps before a complaint, not after.
When do the cybersecurity audit and ADMT rules apply?
ADMT rules apply from January 1, 2027, and cybersecurity audit reports are due between April 1, 2028 and April 1, 2030, depending on revenue. Risk assessments for new covered processing started on January 1, 2026. Existing processing must be assessed by December 31, 2027.
